Hier finden Sie wissenschaftliche Publikationen aus den Fraunhofer-Instituten.

Codescanner: Detecting (Hidden) x86/x64 code in arbitrary files

: Zwanger, V.; Gerhards-Padilla, E.; Meier, M.


Institute of Electrical and Electronics Engineers -IEEE-; IEEE Computer Society:
9th IEEE International Conference on Malicious and Unwanted Software, MALCON 2014. Proceedings : 28-30 October 2014, Fajardo, Puerto Rico, USA
Piscataway, NJ: IEEE, 2014
ISBN: 978-1-4799-7328-6 (Print)
ISBN: 978-1-4799-7329-3
International Conference on Malicious and Unwanted Software (MALCON) <9, 2014, Fajardo/Puerto Rico>
Fraunhofer FKIE ()

Disassembly is indispensable for the proper analysis of malware. However, a common problem concerning the x86/x64 architecture is that disassemblers produce partially incorrect results. This is used by malware authors who nowadays routinely generate binaries with anti-disassembly measures. In this paper, we derive general constraints on x86 code which are not based on disassembly but on byte level. Based on these constraints we develop a set of classifiers able to locate code in any kind of files. Operating on byte level, our approach is independent of assembly semantics. Our evaluation shows that we are able to precisely locate code and provide anti-disassembly resistance independent of the operating system or compiler. Our tool can be used to detect the code sections of malware, improve code coverage for disassemblers, detect hidden code in files and in memory, or identify malware with anti-disassembly techniques.